华赛USG5320防火墙配置使用手册

wt1221

GE 0/0/1：10.10.10.1/24
GE 0/0/2：220.10.10.16/24                        
GE 0/0/3：10.10.11.1/24
WWW服务器：10.10.11.2/24（DMZ区域）
FTP服务器：10.10.11.3/24（DMZ区域）Telnet配置：配置VTY 的优先级为3# 进入系统视图。<USG5300> system-view# 进入用户界面视图[USG5300] user-interface vty 0 3# 设置用户界面能够访问的命令级别为level 3[USG5300-ui-vty0-3] user privilege level 3配置Password验证# 配置验证方式为Password验证[USG5300-ui-vty0] authentication-mode password# 配置验证密码为lantian[USG5300-ui-vty0] set authentication password simple lantian配置空闲断开连接时间# 设置超时为30分钟[USG5300-ui-vty0] idle-timeout 30

华赛USG5320防火墙配置使用手册.pdf (91 KB, 下载次数: 33)

2011-2-26 22:43 上传

点击文件名下载附件

wt1221

地址配置：
内网：
进入GigabitEthernet 0/0/1视图
[USG5300] interface GigabitEthernet 0/0/1
配置GigabitEthernet 0/0/1的IP地址 [USG5300-GigabitEthernet0/0/1] ip address 10.10.10.1 255.255.255.0
配置GigabitEthernet 0/0/1加入Trust区域
[USG5300] firewall zone trust
[USG5300-zone-untrust] add interface GigabitEthernet 0/0/1
[USG5300-zone-untrust] quit

外网：
进入GigabitEthernet 0/0/2视图
[USG5300] interface GigabitEthernet 0/0/2
配置GigabitEthernet 0/0/2的IP地址
[USG5300-GigabitEthernet0/0/2] ip address 220.10.10.16  255.255.255.0
配置GigabitEthernet 0/0/2加入Untrust区域
[USG5300] firewall zone untrust
[USG5300-zone-untrust] add interface GigabitEthernet 0/0/2
[USG5300-zone-untrust] quit
DMZ：
         
进入GigabitEthernet 0/0/3视图
[USG5300] interface GigabitEthernet 0/0/3
配置GigabitEthernet 0/0/3的IP地址。
[USG5300-GigabitEthernet0/0/3] ip address 10.10.11.1  255.255.255.0
[USG5300] firewall zone dmz
[USG5300-zone-untrust] add interface GigabitEthernet 0/0/3
[USG5300-zone-untrust] quit

wt1221

防火墙策略：
Trust和Untrust域间：
policy 1：允许源地址为10.10.10.0/24的网段的报文通过
配置Trust和Untrust域间出方向的防火墙策略。
[USG5300] policy interzone trust untrust outbound
[USG5300-policy-interzone-trust-untrust-outbound] policy 1
[USG5300-policy-interzone-trust-untrust-outbound-1] policy source 10.10.10.0 0.0.0.255
[USG5300-policy-interzone-trust-untrust-outbound-1] action permit
[USG5300-policy-interzone-trust-untrust-outbound-1] quit

DMZ和Untrust域间：
policy 2：允许目的地址为10.10.11.2，目的端口为21的报文通过
policy 3：允许目的地址为10.10.11.3，目的端口为8080的报文通过
配置Untrust到DMZ域间入方向的防火墙策略。
[USG5300] policy interzone untrust dmz inbound
[USG5300-policy-interzone-dmz-untrust-inbound] policy 2
[USG5300-policy-interzone-dmz-untrust-inbound-2] policy destination 10.10.11.3 0
[USG5300-policy-interzone-dmz-untrust-inbound-2] policy service service-set ftp
[USG5300-policy-interzone-dmz-untrust-inbound-2] action permit
[USG5300-policy-interzone-dmz-untrust-inbound-2] quit
[USG5300-policy-interzone-dmz-untrust-inbound] policy 3
[USG5300-policy-interzone-dmz-untrust-inbound-3] policy destination 10.10.11.2 0
[USG5300-policy-interzone-dmz-untrust-inbound-3] policy service service-set http
[USG5300-policy-interzone-dmz-untrust-inbound-3] action permit
[USG5300-policy-interzone-dmz-untrust-inbound-3] quit
[USG5300-policy-interzone-dmz-untrust-inbound] quit
应用FTP的NAT ALG功能。
[USG5300] firewall interzone dmz untrust[USG5300-interzone-dmz-untrust] detect ftp[USG5300-interzone-dmz-untrust] quit
配置内部服务器：
<USG5300> system-view
[USG5300] nat server protocol tcp global 220.10.10.16 8080 inside 10.10.11.2 www
[USG5300] nat server protocol tcp global 220.10.10.17 ftp inside 10.10.11.3 ftp

wt1221

NAT策略：Trust和Untrust域间：
policy 1：允许网段为10.10.10.0/24的内网用户访问Internet时进行源地址转换
配置地址池
[USG5300]nat address-group 1 220.10.10.16 220.10.10.20
配置Trust和Untrust域间出方向的策略
[USG5300] nat-policy interzone trust untrust outbound
[USG5300--policy-interzone-trust-untrust-outbound] policy 1
[USG5300- nat-policy -interzone-trust-untrust-outbound-1] policy source 10.10.10.0 0.0.0.255
[USG5300- nat-policy -interzone-trust-untrust-outbound-1] action source- nat
[USG5300- nat -policy-interzone-trust-untrust-outbound-1] address-group 1

wt1221

IP地址和MAC地址绑定：
将MAC地址为0000-e03f-0305的PC机与IP地址10.1.1.1绑定，掩码为255.255.255.0。
<USG5300> system-view
[USG5300] dhcp server ip-pool 0
[USG5300-dhcp-0] static-bind ip -address 10.1.1.1 mask 255.255.255.0
[USG5300-dhcp-0] static-bind mac-address 0000-e03f-0305

网路游侠

没有电子档吗？下载的那种。